← Vulnerability feed

Vulnerability record · CVE-2024-39736 · published 15 July 2024

CVE-2024-39736: Ibm datacap vulnerability

Ibm · Datacap

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 296003.

9.8 CVSS 3.1 Critical EPSS 0.37% · top 72.1% CWE-644 · CWE-644CWE-116 · CWE-116
9.8CVSS 3.1 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 296003.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/296003 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7160185 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/296003 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7160185 Vendor Advisory

Track CVE-2024-39736 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-4902Ibm datacap navigator sql injection vulnerabilityIBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL state…EPSS 0.97%7.5CVE-2026-8636Ibm datacap vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic…EPSS 0.20%7.5CVE-2024-39731Ibm datacap broken cryptographic algorithm vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp…EPSS 0.28%7.5CVE-2024-39732Ibm datacap cleartext storage of sensitive data vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious…EPSS 0.19%6.1CVE-2026-8059Ibm datacap cross-site scripting vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allow…EPSS 0.24%5.5CVE-2024-39733Ibm datacap insufficiently protected credentials vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Forc…EPSS 0.14%5.4CVE-2025-36027Ibm datacap clickjacking vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali…EPSS 0.22%5.4CVE-2024-39730Ibm datacap vulnerabilityIBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to vi…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2024-39736), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.